Mutation checks, 2026-10-08T11:54Z, Node v22.22.3, Windows 11, Payload 3.90.2.
Each mutation is applied to a fresh copy of the fixture, the whole suite runs, and the failing tests are listed.
A suite that still passed would not be testing that control.

### 1. Any role may publish (src/payload.config.mjs, articleWrite)
ℹ pass 68
ℹ fail 8
✖ overrideAccess: false with the assistant as user: publishing is refused by the access function
✖ publishing
✖ publishing by adding _status to a draft save
✖ the assistant is refused by the server
✖ the reviewer cannot publish, with an API key or a password login
✖ review
✖ the publisher restores the version published before the mistake
✖ a second mistake and a second rollback land on the copy that was live before it
✖ rollback
✖ goes back as a draft that needs a new review
✖ restoring a version that was never published
✖ takes the page offline and puts the approved copy back
✖ the publisher's other rights

### 2. The guard no longer refuses a write without the draft flag (src/workflow.mjs)
ℹ pass 68
ℹ fail 8
✖ editing the live page without the draft flag
✖ the assistant is refused by the server
✖ the reviewer can read the live page, the draft, the history, the log and who decided
✖ the reviewer rejects the draft with a note, and nothing goes live
✖ review
✖ the publisher cannot edit the live page without a draft either
✖ the publisher publishes the approved draft
✖ publishing
✖ the published copy has a mistake: 60 days instead of 30
✖ only the publisher can restore: the reviewer is refused
✖ the publisher restores the version published before the mistake
✖ rollback

### 3. The field rule no longer refuses protected changes; field access alone remains (src/workflow.mjs, writableBy)
ℹ pass 69
ℹ fail 7
✖ overrideAccess: false with the assistant as user: a slug change is refused by the field rule
✖ changing the URL slug
✖ approving its own draft
✖ writing who decided
✖ the assistant is refused by the server
✖ the reviewer cannot change the URL slug either
✖ review
✖ the publisher cannot record a review decision
✖ publishing
✖ creates a new article as a draft, and cannot create it published or with a review decision
✖ the publisher's other rights

### 4. Any role may restore a version (src/workflow.mjs)
ℹ pass 74
ℹ fail 2
✖ restoring a version, including its own earlier draft
✖ the assistant is refused by the server
✖ only the publisher can restore: the reviewer is refused
✖ rollback

### 5. An edit no longer resets the review decision (src/workflow.mjs)
ℹ pass 64
ℹ fail 12
✖ rules written as data invariants still hold under the default
✖ a draft save is accepted and the live page does not change
✖ the assistant proposes a draft
✖ approving its own draft
✖ the assistant is refused by the server
✖ the assistant's revision resets the decision, and a decision on the version read before it is refused
✖ the reviewer amends the draft, and an amendment is not an approval
✖ an edit after approval voids it, and the publisher is refused until the draft is approved again
✖ review
✖ the publisher cannot change content in the publish request
✖ publishing
✖ the publisher restores the version published before the mistake
✖ a second mistake and a second rollback land on the copy that was live before it
✖ rollback
✖ goes back as a draft that needs a new review
✖ restoring a version that was never published
✖ takes the page offline and puts the approved copy back
✖ saves a draft that changes the title and slug, and the draft then needs review
✖ the publisher's other rights

### 6. Unapproved content may be published (src/workflow.mjs)
ℹ pass 65
ℹ fail 11
✖ rules written as data invariants still hold under the default
✖ a rejected draft cannot be published
✖ an edit after approval voids it, and the publisher is refused until the draft is approved again
✖ a save that changes nothing keeps the approval, and the log does not claim a reset
✖ review
✖ the publisher cannot change content in the publish request
✖ publishing
✖ the publisher restores the version published before the mistake
✖ a second mistake and a second rollback land on the copy that was live before it
✖ rollback
✖ goes back as a draft that needs a new review
✖ restoring a version that was never published
✖ takes the page offline and puts the approved copy back
✖ saves a draft that changes the title and slug, and the draft then needs review
✖ creates a new article as a draft, and cannot create it published or with a review decision
✖ the publisher's other rights

### 7. Drafts are no longer validated (src/payload.config.mjs, versions.drafts.validate)
ℹ pass 75
ℹ fail 1
✖ schema validation rejects an invalid draft and nothing is saved
✖ the assistant proposes a draft

### 8. A restore keeps the decision of any version (src/workflow.mjs)
ℹ pass 75
ℹ fail 1
✖ goes back as a draft that needs a new review
✖ restoring a version that was never published

### 9. A decision is no longer bound to the version the reviewer read (src/workflow.mjs)
ℹ pass 75
ℹ fail 1
✖ the assistant's revision resets the decision, and a decision on the version read before it is refused
✖ review

### 10. Unsupported parameters such as unpublishAllLocales are accepted (src/workflow.mjs)
ℹ pass 74
ℹ fail 2
✖ parameters that would rewrite a version in place
✖ the assistant is refused by the server
✖ the reviewer can read the live page, the draft, the history, the log and who decided
✖ review

### 11. No database transactions (src/payload.config.mjs, transactionOptions)
ℹ pass 75
ℹ fail 1
✖ a change and its log entry commit together: a failed entry rolls the change back

### 12. Payload default-style version cap of 50 (src/payload.config.mjs, maxPerDoc)
ℹ pass 75
ℹ fail 1
✖ every version is kept: a long run of draft saves leaves the published versions in place
✖ the publisher's other rights

### 13. Document locking left on for articles (src/payload.config.mjs)
ℹ pass 75
ℹ fail 2
✖ test\payload-core.test.mjs
✖ locking the article against other people's writes
✖ the assistant is refused by the server

### 14. Any signed-in user may clear a login lockout (src/payload.config.mjs, users access.unlock)
ℹ pass 75
ℹ fail 1
✖ clearing another user's login lockout
✖ the assistant is refused by the server

### 15. Bulk updates allowed (src/payload.config.mjs, disableBulkEdit)
ℹ pass 72
ℹ fail 4
✖ updating articles in bulk
✖ the assistant is refused by the server
✖ the reviewer can read the live page, the draft, the history, the log and who decided
✖ review
✖ bulk publishing is refused
✖ publishing
✖ the published copy has a mistake: 60 days instead of 30
✖ rollback

### 16. createdAt accepted from the request (src/workflow.mjs)
ℹ pass 75
ℹ fail 1
✖ changing a timestamp
✖ the assistant is refused by the server

### 17. A decision and a publish may share one write (src/workflow.mjs)
ℹ pass 75
ℹ fail 1
✖ rules written as data invariants still hold under the default

### 18. A decision without a note keeps the earlier note (src/workflow.mjs)
ℹ pass 69
ℹ fail 7
✖ a decision sent without a note clears the earlier note
✖ an edit after approval voids it, and the publisher is refused until the draft is approved again
✖ a save that changes nothing keeps the approval, and the log does not claim a reset
✖ review
✖ the publisher publishes the approved draft
✖ publishing
✖ the published copy has a mistake: 60 days instead of 30
✖ only the publisher can restore: the reviewer is refused
✖ the publisher restores the version published before the mistake
✖ rollback

### 19. An unpublish may carry content changes (src/workflow.mjs)
ℹ pass 71
ℹ fail 5
✖ an unpublish request cannot carry content
✖ the publisher publishes the approved draft
✖ publishing
✖ the published copy has a mistake: 60 days instead of 30
✖ only the publisher can restore: the reviewer is refused
✖ the publisher restores the version published before the mistake
✖ rollback

### 20. The rollback target is ordered by createdAt (src/client.mjs, previousPublished)
ℹ pass 73
ℹ fail 3
✖ a second mistake and a second rollback land on the copy that was live before it
✖ rollback
✖ goes back as a draft that needs a new review
✖ restoring a version that was never published
✖ takes the page offline and puts the approved copy back
✖ the publisher's other rights
